CVE-2024-43437: Moodle: xss risk when restoring malicious course backup file
A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43437?
CVE-2024-43437 has been assessed as a moderate severity vulnerability due to the potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2024-43437?
To fix CVE-2024-43437, upgrade to Moodle versions 4.1.12, 4.2.9, 4.3.6, or 4.4.2 to address the insufficient data sanitization.
What impact does CVE-2024-43437 have on my Moodle installation?
CVE-2024-43437 can allow attackers to execute malicious scripts in a user's browser, potentially compromising user data and session integrity.
Is my Moodle version vulnerable to CVE-2024-43437?
Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, and 4.4.2 are vulnerable to CVE-2024-43437 and should be updated.
Who is affected by CVE-2024-43437?
Any users of Moodle version prior to the specified patches are affected by CVE-2024-43437 due to the nature of the flaw.